Hardened my domains #DNS / #TLS / #CAA by adding #RFC8657 #accounturi and #validationmethod fields. And specifying those per subdomain where necessary, further restricting certificate issuance.